SCS-C02 Data Protection Practice Question
A company stores data in Amazon S3 and wants to ensure that objects are encrypted at rest. The security team decides to use server-side encryption with AWS KMS (SSE-KMS). Which additional benefit does SSE-KMS provide over SSE-S3?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separate permissions for key usage and audit of key usage
SSE-KMS provides separate permissions for key usage and allows auditing of key usage via AWS CloudTrail. Option A is incorrect because both SSE-S3 and SSE-KMS use the same AES-256 encryption algorithm for encryption and decryption. Option B is incorrect because SSE-KMS incurs additional costs for KMS API calls, making it more expensive per object than SSE-S3. Option D is incorrect because both options use the same strong encryption algorithm (AES-256).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Faster encryption and decryption
Why it's wrong here
Performance is comparable between SSE-S3 and SSE-KMS because both use envelope encryption with AES-256 to encrypt objects in S3. SSE-KMS adds a slight latency for each KMS API call to generate or decrypt a data key, but S3 caches KMS keys and the difference is generally negligible for typical workloads. Therefore, choosing SSE-KMS over SSE-S3 does not provide a meaningful speed advantage; the real value lies in control and auditing, not raw encryption throughput.
- ✗
Lower cost per object
Why it's wrong here
SSE-S3 is provided at no additional charge, whereas SSE-KMS incurs per-request costs for every KMS operation, including GenerateDataKey during uploads and Decrypt during downloads, plus a monthly key storage fee if you use a customer-managed key. For high-volume object storage, these KMS API charges accumulate and can make SSE-KMS significantly more expensive than SSE-S3. Thus, SSE-KMS is not a lower-cost option; it is a feature-rich option with a price premium.
- ✓
Separate permissions for key usage and audit of key usage
Why this is correct
SSE-KMS integrates with AWS KMS to provide granular IAM and key policies that separate permissions for who can use a key (e.g., kms:Encrypt, kms:Decrypt) from who can administer it (e.g., kms:PutKeyPolicy, kms:ScheduleKeyDeletion). Additionally, every KMS API call is recorded in AWS CloudTrail, enabling robust audit trails of encryption key usage—something SSE-S3 cannot offer because S3 manages the keys entirely behind the scenes. This separation of duties and auditability is essential for many compliance frameworks, making it the correct benefit.
- ✗
Stronger encryption algorithm
Why it's wrong here
Both SSE-S3 and SSE-KMS use AES-256 as the underlying encryption algorithm for object data, so the cryptographic strength is identical. KMS also uses envelope encryption, but the algorithm itself is not stronger; the difference is in who controls and manages the keys, not in the cipher used. Therefore, choosing SSE-KMS does not provide a stronger encryption algorithm—it provides better key management, permission controls, and compliance capabilities.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.